AI in AppSec: Why Finding Vulnerabilities Is No Longer Enough

In my conversations with security leaders across Asia Pacific, the Middle East and Africa, one challenge keeps coming up: software development is accelerating faster than organisations can secure it.

Generative AI and AI agents are changing how applications are built, and developers can now generate and deploy code at unprecedented speed. Attackers are using AI too. Research from the Cloud Security Alliance shows that the median time to weaponize a vulnerability has collapsed from 840 days to 1.6 days, with AI now able to generate working exploits in minutes. For CISOs, the challenge is no longer just discovering vulnerabilities before attackers do. It is eliminating meaningful risk before it can be exploited.

The growing gap between finding and fixing

Checkmarx's 2026 Future of Application Security Report found that 75% of organisations knowingly release applications containing vulnerable code. The challenge is not simply awareness, but the ability to translate security findings into timely action. Over 12 months, vulnerability submissions rose 76% while monthly fixes shipped fell 46% (The Weather Report, May 2026). Clearing that kind of backlog takes more than extra headcount. It takes a smarter approach to identifying meaningful risks and accelerating remediation.

The measure of effective application security is not how many vulnerabilities an organisation discovers, but how much risk it eliminates.

Moving from detection to elimination

After more than 20 years in application security, we have watched development move from traditional practices to cloud-native, open source and now AI-driven creation. Application security has to move with it, beyond detection to prevention, prioritisation and remediation.

That is the thinking behind our AI-powered capabilities. Checkmarx Fusion brings together proven security analysis and AI reasoning to improve detection precision, so security teams can identify meaningful vulnerabilities with greater confidence. Triage Assist prioritises findings by real attackability in each organisation's environment, while Remediation Assist delivers review-ready fixes in pull requests that a human owner approves before merge. Developer Assist brings security to developers as code is written. Through Checkmarx One, our unified application security platform, these capabilities support a more connected approach to managing application risk.

Security and governance from the start

Having security tools does not mean security is practised. Checkmarx research found that 96% of developers have AI security tooling in their IDEs and rate it highly effective, yet only 18% apply security as code is written. As AI agents take on more code generation, security must be built into the AI-driven development lifecycle (AI-DLC), because every vulnerability prevented early is one less to investigate and fix later.

Governance must keep pace. Only 22% of organisations have formal AI governance policies, so AI adoption is outrunning the controls needed to manage it. That does not mean slowing innovation. It means knowing where AI is used, what risks it introduces, and keeping human oversight where AI assesses risk or proposes changes to production-bound code.

From detection to risk elimination

My advice to security leaders is to rethink how they measure success. Ask three questions: Do we have comprehensive visibility into our application risks? Are we effectively eliminating the risks that matter? Do we have the governance to maintain control as development accelerates?

These questions reflect our approach to Capture, Eliminate and Govern: gaining visibility into risk, taking meaningful action to eliminate it, and keeping oversight and control across the AI-DLC.

Finding vulnerabilities will always matter, but in the AI era it is no longer the measure of success. The organisations that lead will be those that prevent risk earlier, eliminate it faster and stay in control as innovation accelerates.